Splunk Enterprise

How to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard?

Msugiyama
Path Finder

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard. Is there a good idea?

The time picker is also used in another panel, so it is in response to the request that I didn't want to place multiple time pickers.

=== This SPL did not pass. ===
index = _internal
earliest = $ field1.earliest $ --600
latest = $ field1.earliest $ + 600

Labels (1)
0 Karma

Msugiyama
Path Finder

This is awesome!!
Resolved. Thanks!

I will relearn about TOKEN.

0 Karma

Msugiyama
Path Finder

Thank you for reply
What you want to search is the log related to the input to the form of the web page.

When "Today" is specified in the time picker
I can't search for a start and end if started a session at 23:50 yesterday and the session expires at 0:10 today.
For the time being, I would like to set up a buffer for about 10 minutes.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<form>
  <label>Time Picker token</label>
  <init>
    <eval token="earliest10minutesbefore">relative_time(now(),"-10m")</eval>
    <eval token="latest10minutesafter">relative_time(now(),"+10m")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="time" token="time" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
      <change>
        <condition>
          <eval token="earliest10minutesbefore">relative_time(relative_time(now(),$time.earliest$),"-10m")</eval>
          <eval token="latest10minutesafter">relative_time(relative_time(now(),$time.latest$),"+10m")</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>10 minute buffer</title>
      <table>
        <search>
          <query>| makeresults
| eval earliest10minutesbefore= $earliest10minutesbefore$,
latest10minutesafter=$latest10minutesafter$
| eval earliest_time=strftime(earliest10minutesbefore,"%Y-%m-%dT%H:%M:%S"),
latest_time=strftime(latest10minutesafter,"%Y-%m-%dT%H:%M:%S")
| table earliest_time, latest_time, earliest10minutesbefore, latest10minutesafter
| fields - _time</query>
          <earliest>$earliest10minutesbefore$</earliest>
          <latest>$latest10minutesafter$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

ITWhisperer
SplunkTrust
SplunkTrust

You could add a change handler to the timepicker to evaluate new tokens based on the values chosen and use those new tokens for your earliest and latest values.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...